News

Researchers from the Microsoft Defender Security Research team report a rising trend in adversaries using HTTP cookies as the command channel for PHP-based web shells running on Linux hosts, enabling remote code execution without exposing commands in URLs or request bodies.

Rather than embedding instructions in query parameters or POST payloads, these web shells rely on attacker-provided cookie values to authorize execution, convey commands, and turn on harmful behaviors only when the right cookie data is present.

This cookie-driven method increases stealth because the malicious code can remain inactive during normal application activity and only run when requests contain specific cookie markers. According to Microsoft, this gating mechanism can be triggered by regular web traffic, scheduled jobs, or trusted background workers.

The technique leverages PHP’s $_COOKIE superglobal, which makes cookie values readily accessible at runtime without extra parsing. Because cookies look like ordinary web traffic, they tend to draw less attention from monitoring systems, lowering the chance of detection.

Microsoft observed multiple implementation styles for this cookie-controlled execution model:

• A multilayer-obfuscated PHP loader that performs runtime checks, parses a structured cookie payload, and then decodes and runs a secondary, encoded payload.
• A PHP script that breaks a structured cookie into pieces to rebuild operational components-such as file manipulation and decoding routines-and that can conditionally write a follow-up payload to disk and execute it.
• A simpler PHP routine that uses a single cookie value as a trigger to perform actor-controlled tasks like executing provided input or accepting file uploads.

In at least one incident, attackers gained initial entry to a hosted Linux environment either by using legitimate credentials or by exploiting a known vulnerability, then installed a cron job that periodically runs a shell command to launch an obfuscated PHP loader.

This cron-based arrangement acts as a self-restoring mechanism: even if defenders remove the PHP loader during cleanup, the scheduled task can recreate it, preserving a dependable channel for remote code execution. Once placed, the loader stays dormant under normal conditions and activates only when HTTP requests carry the expected cookie values.

Microsoft notes that by separating persistence (handled via cron task re-creation) from execution control (handled via cookie-gated activation), operators cut down on noisy indicators and reduce what appears in routine application logs, making the compromise harder to spot.

A shared thread across the observed variants is the combination of obfuscation to hide sensitive functionality and cookie-based gating to initiate malicious behavior while leaving a small interactive footprint on the server.

To defend against this pattern, Microsoft recommends enforcing multi-factor authentication for hosting control panels, SSH, and other administrative interfaces; watching for anomalous login activity; limiting the availability of interactive shell interpreters; auditing cron jobs and other scheduled tasks on web hosts; monitoring for unexpected file creation within web-accessible directories; and restricting shell-capable features in hosting control panel software.

Microsoft’s researchers emphasize that the consistent use of cookies as a control channel suggests reuse of established web-shell methods. By pushing control logic into cookie values, attackers can achieve lasting post-compromise access that evades many traditional inspection and logging controls. Rather than chaining together new exploits, these actors are exploiting legitimate execution paths already present in environments-web server processes, control-panel components, and cron infrastructure-to deploy and maintain malicious code.